[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

[tor-commits] [Git][tpo/applications/tor-browser][tor-browser-153.0esr-16.0-1] fixup! BB 41598: Prevent NoScript from being removed/disabled.

Title: GitLab

ma1 pushed to branch tor-browser-153.0esr-16.0-1 at The Tor Project / Applications / Tor Browser

Commits:

  • eff748cd
    by hackademix at 2026-07-29T18:50:33+02:00 
    fixup! BB 41598: Prevent NoScript from being removed/disabled.

TB 45157: Grant "access local file" permission to NoScript.

2 changed files:

Changes:

  • toolkit/components/extensions/Extension.sys.mjs
    ... ... @@ -4366,12 +4366,14 @@ export class Extension extends ExtensionData {
    4366 4366 
         }
    4367 4367
    4368 4368 
         // tor-browser#40253: Explicitly allow NoScript in Private Browsing mode.
    4369 
    +    // tor-browser#45157: Grant "access local files" permission to NoScript.
    4369 4370 
         if (this.isNoScript) {
    4370 4371 
           lazy.ExtensionPermissions.add(this.id, {
    4371 
    -        permissions: [PRIVATE_ALLOWED_PERMISSION],
    4372 
    +        permissions: [PRIVATE_ALLOWED_PERMISSION, "internal:fileSchemeAllowed"],
    4372 4373 
             origins: [],
    4373 4374 
           });
    4374 4375 
           this.permissions.add(PRIVATE_ALLOWED_PERMISSION);
    4376 
    +      this.permissions.add("internal:fileSchemeAllowed");
    4375 4377 
         }
    4376 4378
    4377 4379 
         // We only want to update the SVG_CONTEXT_PROPERTIES_PERMISSION during

  • toolkit/mozapps/extensions/content/components/addon-permissions-list.mjs
    ... ... @@ -87,7 +87,15 @@ class AddonPermissionsList extends AboutAddonsHTMLElement {
    87 87 
           },
    88 88 
           {
    89 89 
             buildOptionalOrigins: true,
    90 
    -        includeFileSchemeAccess: lazy.fileSchemeAccessRequiresOptIn,
    90 
    +        // tor-browser#45157: prevent "access local files" from being accidentally
    91 
    +        // toggled off in NoScript, causing Safer and Safest security levels to
    92 
    +        // fail on file:// URLs.
    93 
    +        includeFileSchemeAccess:
    94 
    +          lazy.fileSchemeAccessRequiresOptIn &&
    95 
    +          !(
    96 
    +            fileSchemeAllowed &&
    97 
    +            this.addon.id == "{73a6fe31-595d-460b-a920-fcc0f8843232}"
    98 
    +          ),
    91 99 
           }
    92 100 
         );
    93 101 
         let optionalEntries = [

    • —
    View it on GitLab.
    You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications · Help Notification message regarding https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/eff748cdcedb3112c2a13489fa982b303dec18b0 at 1785344172 

    _______________________________________________
tor-commits mailing list -- tor-commits@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-commits-leave@xxxxxxxxxxxxxxxxxxxx